p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de grafana · Page n° 5

Vulnérabilités publiées pour grafana au cours des 30 derniers jours : 4. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 98

  1. CVE-2021-39226

    Critique · CVSS 9.8EPSS 99,93%Dans le catalogue KEVCode d’exploitation publicAucun correctif publié

    Snapshot authentication bypass in grafana

    Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal

    grafanaSystèmes d’exploitation Logiciels applicatifs
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2020-11110

    Moyenne · CVSS 5.4EPSS 9,62%Code d’exploitation publicAucun correctif publié

    CVE-2020-11110

    Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

    grafanaSystèmes d’exploitation Logiciels applicatifs
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2020-12458

    Moyenne · CVSS 5.5EPSS 0,49%Aucun correctif publié

    CVE-2020-12458

    An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

    grafanaSystèmes d’exploitation Logiciels applicatifs
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2019-15635

    Moyenne · CVSS 4.9EPSS 1,89%Aucun correctif publié

    CVE-2019-15635

    An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.

    grafanaSystèmes d’exploitation Logiciels applicatifs
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2018-1000816

    Moyenne · CVSS 5.4EPSS 0,74%Aucun correctif publié

    CVE-2018-1000816

    Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

    grafanaSystèmes d’exploitation Logiciels applicatifs
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →